Slashdot Mirror
Cryptography Expert Sounds Alarm At Possible Math Hack
netbuzz writes "First we learn from Bruce Schneier that the NSA may have left itself a secret back door in an officially sanctioned cryptographic random-number generator. Now Adi Shamir is warning that a math error unknown to a chip makers but discovered by a tech-savvy terrorist could lead to serious consequences, too. Remember the Intel blunder of 1996? 'Mr. Shamir wrote that if an intelligence organization discovered a math error in a widely used chip, then security software on a PC with that chip could be "trivially broken with a single chosen message." Executing the attack would require only knowledge of the math flaw and the ability to send a "poisoned" encrypted message to a protected computer, he wrote. It would then be possible to compute the value of the secret key used by the targeted system.'"
The problem with backdoors, is that noone can guarantee who uses them. While it allows for (possibly) justified surveillance by our government, it also allows for it by others.
The United States, or the NSA, doesn't have all the world's best cryptographers. Russia, China, etc, other nations have excellent skill in these endeavors. Ironically, by trying to protect the nation, the NSA runs the risk of opening us up to foreign espionage.
So, if a security bug is present an exploit could happen...?
Wouldn't pulling off something like this require a level of knowledge and togetherness more in line with a government agency, rather than a "terrorist" group? The results would also be more in line with what a government agency would want ("we have your secrets, ha!"), rather than what a terrorist would want ("Maybe I can't blow up a bridge / poison your water supply / whatever. But then maybe I can. So while you're deciding whether to go do things or hide under your bed all day, I have a question for you: do you feel lucky?").
Why does everything have to come back to terrorists? They kill a small number of people and people go nuts about them. Hunger, disease, motor cars, lightning, ... All these things have killed far more people than terrorists and they don't get brought up at every *FUCKING* opportunity. Yeah. I'm pissed off. If the terrorism obsessed turned on their brains for a picosecond they might realise that they have caused far more damage than any terrorist has.
Um, no. "The terrorists" (a pretty vauge term but I'm assuming you mean those from middle eastern countries by the way you're wording your statement) don't give a rat's ass how we live, whether we have free elections or live with an oppressive government nor do they really care much about how we go about our daily lives, etc, etc. The terrorists wants the US and western countries to stop fucking around in their countries- supporting/installing dictatorships that happen to ally with our interests while bombing and invading countries that we don't like, setting up permanent military bases and just generally exerting our will on them. After a few generations of having western powers screw with their countries and lives it should be little wonder we're not well liked.
Of course, if you were refering to China or someone else then that might be a different story (but again, the wording sounded like someone regurgitating the drivel that gets thrown out by politicians and pundits in the mainstream media).
Terrorists want us to stop screwing around in the Middle East and Central Asia -- specifically they want us to stop supporting Israel and to stop propping up various dictatorships in countries where there'd be a good chance of overthrowing the government and creating a theocracy.
They don't give a flying f--- about "our freedoms" except where they think that shows we are "morally corrupt." Islamic militants are under no illusions that they're going to change our culture any time soon, though. They've got bigger fish to fry back home trying to establish a power block.
How we govern ourselves beyond our foreign policy is utterly unimportant to their larger goals.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
I can't see any way for an attacker to utilize a math error in a decryption function
Actually this is a common attack scenario in security protocol analysis. While it does not always happen in real life there are ways it can occur. For example, you try to decrypt the message and get garbage. So what do you do? You send the garbage back to the guy, saying, I couldn't read your message, all I got was this junk. Now you have been tricked into acting as what is called an "oracle" for the decryption function. This opens up a number of attacks which is why the best cryptosystems are immune to such problems.
Wow...and I thought I knew the extend of user stupidity, sending back an unsolicited message because you couldn't decrypt it (since it's fairly obvious these people wouldn't be simply sitting around waiting for people to ask them to send an encrypted message) seems to me to be quite absurd, sending it back partially decrypted even more so.
I mean, I could understand it if it was solicited communications, but what are the odds you'll happen to start into an encrypted conversation with someone who just wants your key?
There are two kinds of fool One says 'This is old therefore good' Another says 'This is new therefore better'- Dean Ing
>I can't see any way for an attacker to utilize a math error in a decryption function.
In the same way you aren't the "S" in RSA. Give him some credit, will you?
Want the citizens to give up some freedom/pay some new tax/whatever? Easy! Play the terrorism trump card.
Without some Evil Empire force (that the US plays so well), it is very hard for terrorists to get the emotions going either. Terrorists & empire building governments need each other.
Engineering is the art of compromise.
I think the terrorists have already won, because the whole point of terrorism is...terror, and there are very few *thinking* people who are not afraid of the Patriot Act.
There is strong indication that the main goal of 9/11 was actually against individual freedoms, which this particular brand of "Islam" (they could be fundamentalists of any other religion) does not like. In fact they do not like if people have their own opinions. And they did manage to shiff the US massively in their own direction of thinking. In the end, it seems one fundamentalist is far closer ro another, than to people that are open-minded and tolerant. As an atheist, I believe the main danger of religion is that it can be used as a booster-package for fundamentalists. Many people manage to have religion and still respect others, but a significant number can be coerced into thinking that everybody should subscribe to their particular (and usually bizarre) world-view.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Comment removed based on user account deletion
People generally evaluate risk on largely emotional terms. For this reason, we frequently make gross errors in risk assessment.
1) When we think there's somebody out to get us, we evaluate that risk very highly, even when there are more immediate but "random" risks clearly at hand. For example, a "terrorist" is a bogey-man, it's somebody out to get you. But hunger has no bad guy, and neither do disease, auto accidents, and lightning.
2) We evaluate as "risky" situations where we are not in immediate control, even if they are carefully situated to protect us. For example, riding a horse is far more risky than flying, even in the most dangerous category of flying, single-engine piston planes. Yet people routinely are more concerned about the "motor stalling" in a carefully watched and maintained airplane than they are about their kids riding around without protection on a champion racing horse.
3) Because of our intense pattern-matching, our ability to relate to other people, and our social nature, we routinely underrate risks that are impersonal - the flip-side of #1 above. For example, auto accidents are seen as a "way of life" and "can't be changed" by most, but freak out when the local high-school is held up for a few hours when some teenie gets involved in a love triangle and holds a SINGLE person "hostage" with a pocket knife. Look at the dichotomy - people who don't attend school drive right by a smashed up car on the way to work, tisking as they go, but sit glued to the telly when something happens at the High School.
It's reality. Get used to it. And no, it doesn't make sense.
I have no problem with your religion until you decide it's reason to deprive others of the truth.